Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2024 00:11
Behavioral task
behavioral1
Sample
69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
General
-
Target
69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll
-
Size
112KB
-
MD5
69846d1bcf65f1ddbb961be08ff8f096
-
SHA1
01c0dfa97a2c8a6a0b910151325abeaecc69c825
-
SHA256
f5cce53450b64e071bb938c4d5efb0304ec4876c8a59907276f367e3a0a95d6f
-
SHA512
98df5ee2854a5525f43d08c8256c6f3352bab0bf55616e8c43170b6ce2113aae86ef5f246287e2c5fe6db6e97eaee68a628a280e04a907fa356c27524d6d1c98
-
SSDEEP
3072:g81m+O6rM/TWeHiYzQhLTIhttHU4o4ugkCiHWwx:l1TMvCYWLTIT64N1kJ2W
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000e000000023462-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 3408 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe 3408 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1204 rundll32.exe Token: SeRestorePrivilege 1204 rundll32.exe Token: SeBackupPrivilege 1204 rundll32.exe Token: SeRestorePrivilege 1204 rundll32.exe Token: SeBackupPrivilege 1204 rundll32.exe Token: SeRestorePrivilege 1204 rundll32.exe Token: SeBackupPrivilege 1204 rundll32.exe Token: SeRestorePrivilege 1204 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 8 wrote to memory of 1204 8 rundll32.exe 84 PID 8 wrote to memory of 1204 8 rundll32.exe 84 PID 8 wrote to memory of 1204 8 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD5b05d484e9f149584b01c6c53edf77013
SHA10a1fcd905261fc6e0b34c35b31427ffdc25b0dbc
SHA256425b69f2424a10938bd2aa8dcf43d9c8c18902c54e7489f65d6f276c8cc5eca2
SHA512900dc2c690b321381e015017d8da052a394a8f5ae56420e341f9abf11b616c2017a70799a63a72f91cb3319a6376d1fc239cfc5e38d722166980a574fb15b9a5
